feat(reconcile): add export command to generate desired-state YAML from current state

[rohilsurana]

What

Adds frontier reconcile export --kind <Kind>. It reads the current state of one kind from the server through the admin API and prints it as a desired-state YAML document. Output goes to stdout, or to a file with -o.

$ frontier reconcile export --kind PlatformUser --host <host> -H "Authorization:Basic <base64>"
kind: PlatformUser
spec:
    - type: user
      ref: alice@example.org
      relation: admin

Why

When an environment adopts the reconcile flow, its first desired-state file must match what already exists on the server. If it does not, the first apply makes unwanted changes. Writing that file by hand from list APIs is slow and easy to get wrong.

How

• New optional Exporter interface next to Reconciler. A kind that implements it can be exported. Kinds that do not implement it return a clear error.
• PlatformUser implements it: one entry per principal and relation, users referenced by email when they have one, service users by id. The bootstrap service account is skipped, the same as in reconcile.
• Output is sorted, so re-running the export gives the same file and git diffs stay clean.
• An empty platform exports spec: [], which reconcile accepts as an intentional empty list.

Guarantees covered by tests

• Feeding the export output straight back into reconcile --dry-run reports no changes.
• Export of an empty platform round-trips the same way.
• Unknown kinds and kinds without export support fail with clear errors.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	Jul 3, 2026 2:42am

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added a new reconcile export command to generate a YAML snapshot of a selected resource type.
  • Exported output can be printed to the terminal or saved to a file.
  • Exports are now returned in a consistent order for easier review and reuse.

• Bug Fixes

  • Improved validation and error handling when exporting unsupported or unregistered resource types.
  • Added coverage to ensure exporting and reconciling exported content behaves as expected.

Walkthrough

This PR adds an export capability to the reconcile framework: a new Exporter interface and Export function in internal/reconcile/reconcile.go, a PlatformUserReconciler.Export implementation producing sorted specs, a reconcile export CLI subcommand, and corresponding tests.

Changes

Reconcile Export Feature

Layer / File(s)	Summary
Exporter interface and Export function internal/reconcile/reconcile.go, internal/reconcile/reconcile_test.go	Adds Exporter interface and Export(ctx, registry, kind) function that looks up a reconciler, calls its Export, and marshals a YAML document with kind and spec; tests cover missing-kind and unsupported-export errors.
PlatformUserReconciler.Export implementation internal/reconcile/platformuser_reconciler.go, internal/reconcile/platformuser_reconciler_test.go	Implements Export to fetch current principals, build PlatformUserSpec entries (using email for users, excluding bootstrap service account), sort deterministically, and return them; tests verify sorting, email fallback, no-op reconciliation after export, and empty-platform export.
CLI export subcommand and registry refactor cmd/reconcile.go	Extracts reconcileRegistry helper and adds reconcile export subcommand with --kind, --output, --header flags that calls reconcile.Export and prints or writes YAML output.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• raystack/frontier#1720: Establishes the GitOps reconcile/PlatformUser reconciliation framework that this PR extends with export functionality.

Suggested reviewers: AmanGIT07, rsbh, whoAbhishekSah

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 75607dba-a629-489d-b90a-5de555cb5f68

📥 Commits

Reviewing files that changed from the base of the PR and between 4a8d725 and 2ca9edd.

📒 Files selected for processing (5)

• cmd/reconcile.go
• internal/reconcile/platformuser_reconciler.go
• internal/reconcile/platformuser_reconciler_test.go
• internal/reconcile/reconcile.go
• internal/reconcile/reconcile_test.go

[coveralls]

Coverage Report for CI Build 28634880341

Coverage increased (+0.09%) to 44.924%

Details

• Coverage increased (+0.09%) from the base build.
• Patch coverage: 25 uncovered changes across 3 files (70 of 95 lines covered, 73.68%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
cmd/reconcile.go	49	30	61.22%
internal/reconcile/reconcile.go	21	17	80.95%
internal/reconcile/platformuser_reconciler.go	25	23	92.0%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	37695
Covered Lines:	16934
Line Coverage:	44.92%
Coverage Strength:	12.59 hits per line

---

💛 - Coveralls